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^400 

8KB bit-table 

1 01 1 1 0001 001 001 00001 00001 0000000001 
000001 001 001 0001 0001 0001 00001 0001 01 
0001 001 000001 000001 000100001 0001 000 
1 00000001 00001 001 00001 0001 001 001 001 
001 0001 001 01 0001 001 0001 000001 000001 



001 001 00001 0001 0001 001 011 1 1 00001 01 0 
0001 0001 001 0001 0000001 01 1 1 00001 0000 
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Verifier Element 



Verification tests: <crc, tracelnfb, cpri> 

CRC1 : <crc used for verification> 

CRC2: <a secondary crc used for 
verification as necessary> 

crdjen: <number of instaictions 
represented by CRC1> 

crc2_len: <number of instructions 
represented by CRC2> 

crc1_modei: <modei represented by crc1> 

crc2_modei: <modei represented by crc2> 

TRACEiNFO: <trace infonnation tliat can 
be used as verifiers> 

CPRL: <small cpri string used to verify 
information for this known virus> 

Virus Name: <name of the virus ttiis verifier 
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Any two byte CRC contains a value from 0 to 65535. An eight l<ilobyte table contains 
65536 bits. Therefore each bit in the 8k table can therefore represent a value from 0 
(the first bit) to 65535 (the last bit). In other words, every value form 0 to 65531 can be 
represented by a single bit in and 8k table. 

The following is an example of an algorithm that can be used to mask a CRC value to 

a single bit in the table: 

C = CRC; B = Byte in table that contains the bit. b = the bit number that represents 
C. M = mask byte. 

Note: Bit values 0 to 7 are represented by location, not by value. 

Example: 

1000000 = bit 0 set. 
0000100 = bit 5 is set. 

Algorithm 

b = C'^8 
B = C/8 

Set high bit only in M (1000000) 

Shift byte right by count b. (if b = 0 then no shift occurs) 

Bitwise AND M against B. 

If NOT zero then match. 



Pseudo Code 




boolean 




MASK (WORD C, 


//CRC 


BYTE *TABLE) 


// pointer to table 


{ 

WORD B; 


// which byte in table 


BYTE b; 


// bit count 


BYTE M; 


// bit mask 


BYTE *N: 


// pointer to byte in table 


M = 0x8000; 


// initialize to binary 10000000 


B = C / 8; 


// number of byte in table 


b = C 8; 


// remainder of C / 8 


N = TABLE + B; 


// point to byte in table 


M = M » b; 


// shift right 0 to 7 bits 


if (M AND *N) 


//AND Mask and Byte N in table 


return true; 


// bit is set 


return false; 


// bit is not set. 



} 



